Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

The version of WebSphere Application Server installed on the remote host is 8.0.x through 8.0.0.15, 8.5.x prior to 8.5.5.20, or 9.0.x prior to 9.0.5.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 6453091 advisory, including the following:

  - http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the     http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause     a denial of service (HTTPS call hang) via unspecified vectors. (CVE-2015-5262)

  - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and     HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in     the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via a CN= string in a field in the distinguished name (DN) of a     certificate, as demonstrated by the foo,CN=www.apache.org string in the O field. (CVE-2014-3577)

  - http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify     that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field     of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate     with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists     because of an incomplete fix for CVE-2012-5783. (CVE-2012-6153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     HttpClient component of the Apache HttpComponents     library. An attacker can exploit this issue by     sending a Proxy-Authorization header to retrieve a     user's password. (CVE-2011-1498)

  - An unspecified cross-site scripting vulnerability     exists due to improper validation of user input. An     attacker can exploit this issue to execute code in     the security context of a user's browser.
    (CVE-2014-3102)

  - An information disclosure vulnerability exists due to     the returned error codes which an attacker can use to     identify devices behind a firewall. (CVE-2014-4746)

  - An unspecified open redirect vulnerability exists that     can allow an attacker to perform a phishing attack by     enticing a user to click on a malicious URL.
    (CVE-2014-4760)

This updated fixes several bug. See http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1 .x.txt for details

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
149787	IBM WebSphere Application Server 8.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.20 / 9.0.x < 9.0.5.8 Multiple Vulnerabilities	Nessus	Web Servers	high
77533	IBM WebSphere Portal 8.x < 8.0.0.1 CF13 Multiple Vulnerabilities	Nessus	CGI abuses	medium
55147	Fedora 15 : httpcomponents-client-4.1.1-2.fc15 (2011-7747)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1498

medium

Tenable Plugins

high

medium

medium